# Licence texts shipped with the Cherry binary

Every file under this directory is a byte-for-byte copy of a licence text
taken from the installed component itself - the wheel's `dist-info` folder
or, for Python, the runtime's own `LICENSE.txt`. Nothing here was typed,
paraphrased or reconstructed. `LICENCE-REGISTER.md` (shipped beside this
directory) is the register those copies satisfy: it names every component,
the licence read, and whether it can ship inside a paid binary.

Both PyInstaller specs (`packaging/windows/cherry.spec`,
`packaging/macos/cherry.spec`) add this whole directory to the bundle as
`packaging/licences`, and the CI smoke step fails the build if it is
missing from the onedir output. `tests/test_licence_texts.py` fails the
repository gate if any register row that ships lacks its text here.

Harvested 2026-08-22 from the repository venv, whose installed versions
were verified against the register that day: rawpy 0.27.0 over LibRaw
0.22.1 (`rawpy.libraw_version`), numpy 2.5.2, pillow 12.3.0,
opencv-python-headless 5.0.0.93, Python 3.12.10.

| Directory | Component | Version | Licence per the register | Files |
|---|---|---|---|---|
| `python/` | Python runtime | 3.12.10 | PSF-2.0 | `LICENSE.txt` from `sys.base_prefix` |
| `numpy/` | numpy | 2.5.2 | BSD-3-Clause AND 0BSD AND MIT AND Zlib AND CC0-1.0 | the wheel's full `licenses/` tree, 17 files, including the vendored components (pocketfft, lapack_lite, highway, svml, x86-simd-sort, libdivide, dragon4, pythoncapi-compat, the random-number sources) |
| `pillow/` | Pillow | 12.3.0 | MIT-CMU | `LICENSE` |
| `opencv-python-headless/` | opencv-python-headless | 5.0.0.93 | wrapper MIT (`LICENSE.txt`); OpenCV itself Apache-2.0 and the bundled libraries in `LICENSE-3RD-PARTY.txt` | both files |
| `rawpy/` | rawpy | 0.27.0 | MIT | `LICENSE` |
| `libraw/` | LibRaw, bundled inside the rawpy wheel as a separate shared library | 0.22.1 | LGPL-2.1 arm of the LGPL-2.1 / CDDL-1.0 dual licence (the text the wheel ships) | `LICENSE.LibRaw` plus `SOURCE-OFFER.md` |

## Components that ship no text, and why

- **PyInstaller.** Only its bootloader, loader and run-time hooks reach the
  packaged binary. The bootloader and loader are covered by PyInstaller's
  Bootloader Exception and the hooks are Apache-2.0, so the output carries
  no GPL obligation and no PyInstaller text is required in it. See the
  PyInstaller row in `LICENCE-REGISTER.md`.
- **YuNet face model.** The model file (`face_detection_yunet_2023mar.onnx`)
  is not in the repository and is not packaged; engine one uses it only if a
  user places it beside the engine. Its MIT notice ships only if the model
  ever does.

## Integrity

SHA-256 of every copied file, recorded at harvest so drift is visible:

| File | Bytes | SHA-256 |
|---|---|---|
| `python/LICENSE.txt` | 36,874 | `e502c6b880ff58d614901495a9009c136539cd0b1e2a2abb8fc00b934c203419` |
| `numpy/licenses/LICENSE.txt` | 45,831 | `a804dff0ead9fadc5293456410bcbfc32bf024be9c4513459663fb7b442d2341` |
| `numpy/licenses/numpy/_core/include/numpy/libdivide/LICENSE.txt` | 1,039 | `d544761558b510866c21f7e8a2d5716fca76e0b98117e3b6b86314db7244d150` |
| `numpy/licenses/numpy/_core/src/common/pythoncapi-compat/COPYING` | 704 | `aea41976c720f91bd19725c16916a1ace40eb1ea42620d340e587a5de4bbcea0` |
| `numpy/licenses/numpy/_core/src/highway/LICENSE` | 21,155 | `d208152e2777ffd0126eacc1bd21c0320d69e4e6b622d21a2a12a47e8ef73763` |
| `numpy/licenses/numpy/_core/src/multiarray/dragon4_LICENSE.txt` | 1,441 | `b0fd592d4ead563148e3977e7b589169d46a5ef2ff133c755a81af880a3fc919` |
| `numpy/licenses/numpy/_core/src/npysort/x86-simd-sort/LICENSE.md` | 1,542 | `a732977853530066790c42817087f4829b518dd98d340c916acbfd227e39d3cb` |
| `numpy/licenses/numpy/_core/src/umath/svml/LICENSE` | 1,573 | `585483905b13d4b42f800c55ba99e89d6e2e33ccd5f503e201c07531d148ff41` |
| `numpy/licenses/numpy/fft/pocketfft/LICENSE.md` | 1,523 | `8db000e158c162e7249787852d8c69764706502ccee725c06641b31c1e95c8af` |
| `numpy/licenses/numpy/linalg/lapack_lite/LICENSE.txt` | 2,314 | `19060ef465e1797d682ee0fc3081bd25ab1395e995e43d25c9d13c95d9a3cd6b` |
| `numpy/licenses/numpy/ma/LICENSE` | 1,616 | `d78dbb208b80d92b4d333e41a4baae50d12444f46e53199fa7726a91de6e2da7` |
| `numpy/licenses/numpy/random/LICENSE.md` | 3,582 | `b4bc2f4fa1c95778f1ed3dd8f14706bece399475b978f9f34b5d3cd72521b48a` |
| `numpy/licenses/numpy/random/src/distributions/LICENSE.md` | 2,805 | `cf5619f25b112d5ce7c896efffc8e610bcb345dfadcc19f2c1460aa48fff2c9e` |
| `numpy/licenses/numpy/random/src/mt19937/LICENSE.md` | 2,986 | `92c10699884321f1c2947fe2a70ab23b0fbf1507f756d89dd08f38c61fc3d4fa` |
| `numpy/licenses/numpy/random/src/pcg64/LICENSE.md` | 1,176 | `41190663b77bee5302386495a07b7eabfbfa571aa0ae2f11da6764162062fc4f` |
| `numpy/licenses/numpy/random/src/philox/LICENSE.md` | 1,540 | `322ac46d870c8aeead6c53adcccc839296fb3c8e456eae155081297daf7f8013` |
| `numpy/licenses/numpy/random/src/sfc64/LICENSE.md` | 1,253 | `28cad82ce1379dc529df30da78ec012d7d0d1d576b03ddcb93388aee53659f59` |
| `numpy/licenses/numpy/random/src/splitmix64/LICENSE.md` | 340 | `454ec7350e478e037061850b67395753b425b1cb0a34bbc26290b020bf89d763` |
| `pillow/LICENSE` | 78,016 | `4f7866a74802c6326f81faff59a56546b6aec2b10b91973e0e9308de95e79857` |
| `opencv-python-headless/LICENSE.txt` | 1,090 | `edef0fac1eb08d29d34563f724742e078da2513e196133a12c6ad9ff01e26107` |
| `opencv-python-headless/LICENSE-3RD-PARTY.txt` | 183,251 | `c1d60169b55cee56452b227c2fd2a7b9ddda3dd3741065f1c6201072be73fadb` |
| `rawpy/LICENSE` | 1,101 | `d8bca797bbaab143cf2986c0285118db81aff769f500e9af0c2a5bb74407e9f3` |
| `libraw/LICENSE.LibRaw` | 24,847 | `90629b9cbfd2b66ce27a78bbc8c9a302e66f57c0067e1205a4943ae9c2ab0311` |

If a dependency is upgraded, harvest again from the new wheel and update
the register row, this table and the per-component README in the same
commit. The texts describe the bytes that ship; a text for a version that
no longer ships is wrong, not merely stale.
